Interestingly, it seems that many search engines want to provide my blog as a result when folks want to know something about zombie processes, even though this site has nothing to do with them per se. As such, I will discourse for a bit on the seemingly morbid topic of Zombie Processes, this site’s namesake.
What is a zombie process?
When a process finishes execution, it will have an exit status to report to its parent process. Because of this last little bit of information, the process will remain in the operating system’s process table as a zombie process, indicating that it is not to be scheduled for further execution, but that it cannot be completely removed (and its process ID cannot be reused) until it has been determined that the exit status is no longer needed.
When a child exits, the parent process will receive a SIGCHLD signal to indicate that one of its children has finished executing; the parent process will typically call the wait() system call at this point. That call will provide the parent with the child’s exit status, and will cause the child to be reaped, or removed from the process table.
How do I see if there are zombie processes on a system?
Run “ps aux” and look for a Z in the STAT column.
How do I remove zombie processes from a system?
Well, first you can wait. It’s possible that the parent process is intentionally leaving the process in a zombie state to ensure that future children that it may create will not receive the same pid. Or perhaps the parent is occupied, and will reap the child process momentarily.
Secondly, you can send a SIGCHLD signal to the parent (“kill -s SIGCHLD <ppid>“). This will cause well-behaving parents to reap their zombie children.
Finally, you can kill the parent process of the zombie. At that point, all of the parent’s children will be adopted by the init process (pid 1), which periodically runs wait() to reap any zombie children.
Why did you name your blog Zombie Process?
Zombie Process 
Trying to kill follow the above process. but no result is same ….
Last try to “killall pid” and and the zombie and its parents are cleared from the process list..
Riyad
ps -eo pid,ppid,user,args,stat –sort stat
ppid is the parent process id
Hey,
How can I know when a certain zombie process has terminated?
Thanks ahead!
–sternr
@sternr:
Sorry to say that there is no indication that a zombie process has been reaped, except by watching the process table to see when it drops off.
So Mike what u mean to say is until wait() function has been called by the parent process, the child remains as a zombie process?
If yes, then does that mean that it is mandatory to call the wait() function after the child exits?
Thanks ahead
Jatinder
Jainder:
“Mandatory” may be a strong word, but it is certainly good programming practice. If the process is long-running (a daemon, for example), and spawns many children that are never reaped, there will be many zombie processes milling about. In the case of a short-running process, the zombie children will be adopted by the init process when the parent is terminated, and the init process will take care of reaping them.
So, it’s not “mandatory,” but I would definitely characterize it as “highly, highly, highly recommended.”
Thanks,
Mike
what happens when we directly send kill signal to
zombie process by
kill -9 pid
pid -zombie process pid
I suppose it technically depends on the OS implementation, but I would not expect “kill -9” to eliminate the zombie from the process table. The process is already dead. Killing the parent of the zombie would eliminate the zombie, but I don’t think that’s what you are asking.
To be clear, zombie processes consume so few system resources that it should not be a concern to have several lingering around. It would be a concern if there are a lot, but that would likely mean that there is a significant bug in a component of your software stack…
Thanks,
Mike
i didn’t understood the second method of killing the zombie process,since the SIGCHILD signal is given to parent when child exits.So hw can it remove the zombie process?
If there is an issue in the design of the program for the parent process, it may have missed or otherwise not processed the initial SIGCHLD that was issued when the child process exited. This gives the parent process another chance to correctly handle the terminating child (presumably, the parent process is in a different state, and may be able to correctly process the signal this time around).
No one can kill Zombie even in real world.
can u tell me something about orphan processes???
An orphan process is a running process whose parent has terminated; the parent process becomes the init process (just like a zombie process whose parent has terminated without reaping it). Orphan processes are frequently intentional; it is common for daemons to be orphan processes, for example. The nohup command is a common way to create such a process.
Since init calls wait() periodically, an orphan process will typically not become a persistent zombie process when it exits.
zombie is a process not to removed at all
I read about zombie processes.. I just want to ask do they hold resources even after that process has finished its execution???
Not really, nothing other than a space on the process table. The only reason the zombie exists is to report its exit status to a parent; no file descriptors, memory, etc. are maintained.
how to kill a process?
Mikee,
I got it that zombie process has little overhead as its occupying process Id and probably kernel will not destroy related Data.
But is there any side effect of Orphan Process??
Hi Mike,
Can you suggest me how to create a zombie process?
if the parent explicitly ignores SIGCHLD by setting its handler to SIG_IGN (rather than simply ignoring the signal by default) or has the SA_NOCLDWAIT flag set, all child exit status information will be discarded and no zombie processes will be left.
can u explain this once.
Really nice article. Thanx for clearing up few confusions.
Can you comment on ninja and pirate processes? There are zombies and daemons so I assume these two must also exist.
Is there a method to forcefully remove the zombie process on Linux like the Solaris preap command if the ppid is already 1.
Can you tell me sumthng abt the fork proc?? and also that since every proc uses a fork proc to create a new proc then who creates that new proc??
What will happen to child processes if –
a) they are running
or
b) in zombie state
or
c) terminated (is it possible?)
and parent is exited without waiting for children?
If the parent dies, the process becomes an orphan process and init takes control, and can then do whatever it wants with the process.
Can you explain the interrupted system call signal
Hi mike,
I read your article. I already know about all zombie process and as well as about bots on internet. I am new to ubuntu and i have seen a process “zeitgeist-datah” running in zombie state. I have studied about DDOS attack. I am worried that is this process which is running in zombie state is safe or not. I am using ubuntu 11.4 natty version. how to know about his parent so, i can kill this zombie by its parent ID.
You can obtain the PID of the parent process with “ps -fe”. The value in the PPID column is the one you are looking for.
Thanks about your help. i am very glad.
Souvik